CVE-2016-8641

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A privilege escalation vulnerability was found in nagios 4.2.x that occurs in daemon-init.in when creating necessary files and insecurely changing the ownership afterwards. It's possible for the local attacker to create symbolic links before the files are to be created and possibly escalating the privileges with the ownership change.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-59

Affected software

No affected versions have been published.

Timeline

Published: Aug 1, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-86425.3In Moodle 2.x and 3.x, the question engine allows access to files that should not be available.CVE-2016-86434.3In Moodle 2.x and 3.x, non-admin site managers may accidentally edit admins via web services.CVE-2016-86445.3In Moodle 2.x and 3.x, the capability to view course notes is checked in the wrong context.CVE-2016-86455.5The TCP stack in the Linux kernel before 4.8.10 mishandles skb truncation, which allows local users to cause a denial of service (system cra CVE-2016-86465.5The hash_accept function in crypto/algif_hash.c in the Linux kernel before 4.3.6 allows local users to cause a denial of service (OOPS) by a CVE-2016-86474.9An input validation vulnerability was found in Ansible's mysql_user module before 2.2.1.0, which may fail to correctly change a password in CVE-2016-86487.2It was found that the Karaf container used by Red Hat JBoss Fuse 6.x, and Red Hat JBoss A-MQ 6.x, deserializes objects passed to MBeans via CVE-2016-86499.1lxc-attach in LXC before 1.0.9 and 2.x before 2.0.6 allows an attacker inside of an unprivileged container to use an inherited file descript CVE-2016-86505.5The mpi_powm function in lib/mpi/mpi-pow.c in the Linux kernel through 4.8.11 does not ensure that memory is allocated for limb data, which CVE-2016-86513.5An input validation flaw was found in the way OpenShift 3 handles requests for images. A user, with a copy of the manifest associated with a CVE-2016-86525.9The auth component in Dovecot before 2.2.27, when auth-policy is configured, allows a remote attackers to cause a denial of service (crash) CVE-2016-86535.3It was found that the JMX endpoint of Red Hat JBoss Fuse 6, and Red Hat A-MQ 6 deserializes the credentials passed to it. An attacker could